REMARKS 

Applicants respectfully request further examination and reconsideration in view of 
the instant response. Claims 1-20 remain pending in the case. Claims 1-20 are 
rejected. 

Independent Claims 1, 8 and 15 have been amended. No new matter has been 
added. For example, support for the amendments to independent Claims 1 , 8 and 1 5 
can be found in the instant application serial no. 10/637,172 at originally filed 
independent Claim 1, last 3 sentences on page 14, page 14 lines 13-18, last sentence 
on page 14 through line 2 on page 15, page 15 last paragraph, and last sentence on 
page 14 through line 2 on page 15, among other places in the originally filed instant 
application. 

IMPROPER TO MAKE NEXT OFFICE ACTION FINAL 
MPEP 2144.04 (D) states, "If... a new ground of rejection is introduced by the 
examiner that is not necessitated by applicant's amendment of the claims, the rejection 
may not be made final. See MPEP 706.07(a)." Claims 1 , 8 and 1 5 were not amended 
to get over the asserted art. Therefore, Applicants respectfully submit that although 
Applicants amended Claims 1, 8 and 15, should the following arguments be found to be 
persuasive, Applicants respectfully submit that it would be improper to make the next 
Office Action final. 

35 U.S.C. 112, 1 st PARAGRAPH 

The Office Action rejected Claims 1-20 under 35 U.S.C. 112, first paragraph. 35 

U.S.C. 112, 1 st paragraph states, 

The specification shall contain a written description of the invention, and of the 
manner and process of making and using it, in such full, clear, concise, and exact 
terms as to enable any person skilled in the art to which it pertains, or with which 
it is most nearly connected, to make and use the same,... 

The Office Action states, "... there is no disclosure of the registering being done 
by the application that was brought up." Applicants' respectfully submit that the Office 
Action has misquoted the embodiments recited by independent Claims 1, 8 and 15. For 
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example, independent Claims 1, 8 and 15 recite, "which was created when an 
application registered a service provided by the application with said port mapper at the 
time said application was brought up" not "the registering being done by the application 
that was brought up." 

Support for the amendments to Claims 1, 8, and 15, that are rejected herein 
under 35 U.S.C. 112, first paragraph, can be found in the instant application serial no. 
10/637,172 at originally filed independent Claim 1, last 3 sentences on page 14, page 

14 lines 13-18, last sentence on page 14 through line 2 on page 15, page 15 last 

paragraph, and last sentence on page 14 through line 2 on page 15, among other 

places in the originally filed instant application. For example, the instant application 

states on page 15 lines 12-21, 

RPC, in implementations envisioned in these embodiments, provides support for 
authenticating a calling program on one device to a target subroutine on another. 
Authentication can operate in several different modes. It is noted that RPC 
allows services freedom from being tied to a given port number. It does so using 
a special RPC service called PORTMAPPER or RPC bind. These binding 
protocols , often referred to as the portmapper, are unique among RPC services 
since they have an assigned port of their own (port 111). Other RPC services , 
running on any port number, can register themselves using an RPC call to port 
111. The portmapper offers other RPC calls to permit service lookup (emphasis 
added). 

The instant application also states at page 14 lines 13-15, "The port binding of a 
particular application , when the application is brought up . is able to be bound to a 
Portmapper and its services are born on a particular port " (emphasis added). The 
instant application further states starting at the last sentence of page 14 through page 

1 5 line 2, "Then these embodiments are enabled to query the portmapper in order to 
verify whether the identified services are in fact using the authorized port " (emphasis 
added). Therefore, Applicants respectfully submit that the instant application does 
provide explicit support for "accessing port binding information, which includes an 
identification and an authorized port of an authorized service, in a port authorization file 
in said network; querying a port mapper for a mapped port assignment, which was 
created when an application registered a service provided by the application with said 
port mapper at the time said application was brought up, said mapped port assignment 
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includes a current port used by said registered service; determining if an identified 
service is currently using said authorized port by comparing said mapped port 
assignment to said port binding information," as recited by independent Claim 1. 
Independent Claims 8 and 15 recite similar features. 

Therefore, Applicants respectfully submit the embodiments of independent 
Claims 1, 8 and 15 comply with the requirements of 35 U.S.C. 112, first paragraphs for 
at least the reasons, as described herein, that the instant specification contains a written 
description of the invention, and of the manner and process of making and using it, in 
such full, clear, concise, and exact terms as to enable any person skilled in the art to 
which it pertains, or with which it is most nearly connected, to make and use the same. 

Further, Applicants respectfully submit that MPEP21 63.04 states "The examiner 
has the initial burden of presenting by a preponderance of evidence why a person 
skilled in the art would not recognize in an applicant's disclosure a description of the 
invention defined by the claims. Wertheim, 541 F.2d at 263, 191 USPQ at 97" 
(emphasis added). Therefore, Applicants respectfully request that if future Office 
Actions rejection claims under 35 U.S.C. 112, first paragraph, that the future Office 
Actions accompany the rejections with a preponderance of evidence as to why a 
person skilled in the art would not recognize in Applicants' disclosure a description of 
the invention defined by the claims 

35 U.S.C. 112, 2 nd PARAGRAPH 
The Office Action rejected Claims 1-20 under 35 U.S.C. 112, second paragraph. 
Independent Claims 1, 8 and 15 have been amended to address the antecedent basis 
problems indicated in the Office Action. Therefore, Applicants believe that these 
rejections have been addressed. 

35 U.S.C. 101 

The Office Action rejected Claims 1-14 under 35 U.S.C. 101. Applicants have 
amended independent Claim 1 to recite "accessing, performed by a computer system" 



200300376-1 

Examiner: Pich, Ponnoreay 



9 



Serial No.: 10/637,172 
Group Art Unit: 2435 



and have amended independent Claim 8 to recite "a port assignment file, stored in an 
electronic device," Therefore, Applicants respectfully submit that independent Claims 1 
and 8 are tied to statutory subject matter. Claims 2-7 depend on independent Claim 1. 
Claims 9-14 depend on independent Claim 8. These dependent claims include all of the 
features of their respective independent base claims. Therefore, these dependent 
claims recite statutory subject matter for at least the reasons that their respective 
independent base claims include statutory subject matter. 



AMENDMENTS TO THE SPECIFICAITON 

Applicants have amended the specification to provide antecedent basis for the 

term "electronic device" and "computer system." MPEP 608.01 (o) states, 

The meaning of every term used in any of the claims should be apparent from 
the descriptive portion of the specification with clear disclosure as to its import... 

...While an applicant is not limited to the nomenclature used in the application as 
filed, he or she should make appropriate amendment of the specification 
whenever this nomenclature is departed from by amendment of the claims so as 
to have clear support or antecedent basis in the specification for the new terms 
appearing in the claims. This is necessary in order to insure certainty in 
construing the claims in the light of the specification, Ex parte Kotler, 1902 CD. 
62, 95 O.G. 2684 (Comm'r Pat. 1 901 ). See 37 CFR 1 .75, MPEP §608.01 (i) and 
§1302.01. 



Support for these amendments can be found in the instant application in the last three 
lines on page 8, among other places. 

35 U.S.C. 102 

On page 4, the Office Action rejected Claims 1-6, 8-11, 14-18 and 20 as being 
anticipated under 35 U.S.C. 102(a) by U.S. Patent Application Publication No. 
2002/0144156 by Copeland III et al. (referred to hereinafter as "Copeland"). Applicants 
have reviewed the asserted art and respectfully submit that Copeland does not teach 
and the embodiment recited by amended independent Claim 1 for at least the following 
rationale. 



200300376-1 

Examiner: Pich, Ponnoreay 



10 



Serial No.: 10/637,172 
Group Art Unit: 2435 



COPELAND 

This section describes Applicants' understanding of what Copeland teaches. 
Copeland teaches creating a host port profile based on ports from TCP headers that are 
analyzed for a period of time (0067, 0069, 0070, 0074) because "[initially a network 
administrator may not know all the client and server applications that are running on 
their network" (0069). The ports that are obtained over a period of time and thus part of 
the host port profile are considered to be "normally used ports." Further, "... the 
services are automatically updated in the profile" (0069). The network administrator can 
subsequently modify the ports in the host port profile (last sentence of 0022). After 
Copeland has created a host port profile that is "accurate" because it includes ports that 
were normally used during the period of time," Copeland teaches collecting ports from 
observed TCP headers (referred to herein as "observed ports") into flow data structures 
and comparing his "observed ports" to the "normally used ports" in his host port profile 
to determine if the services associated with the observed ports are normally used or not 
normally used (abstract, 0062-0064, 0066, 0157). More specifically, if the observed 
ports are found in his host profile they are "in profile" and are considered "normally 
used." If the observed ports are not in his host port profile, they are "out of profile" and 
are considered "not normally used." 

DIFFERENCES BETWEEN COPELAND AND CLAIM 1 
This section describes Applicants' understanding of at least some of the 
differences between what Copeland teaches and the embodiment recited by amended 
independent Claim 1. 

MPEP §2131 provides: 

"A claim is anticipated only if each and every element as set forth in the 
claim is found, either expressly or inherently described, in a single prior art 
reference." Verdegaal Bros. v. Union Oil Co. of California, 814 F.2d 628, 
631, 2 USPQ2d 1051, 1053 (Fed. Cir. 1987). ... "The identical invention 
must be shown in as complete detail as is contained in the ... claim." 
Richardson v. Suzuki Motor Co., 868 F.2d 1226, 1236, 9 USPQ2d 1913, 
1920 (Fed. Cir. 1989). The elements must be arranged as required by the 
claim. 
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Applicants respectfully submit that Copeland does not teach the embodiment recited by 
amended independent Claim 1 for at least the following rationale. 

Applicants note that the board's decision dated February 25, 2010 drew a 
comparison between Copeland's automatic build up of normally used ports in his post 
port profile based on analyzed TCP header information to "querying a port mapper for a 
mapped port assignment." Applicants do not understand Copeland's automatic build up 
of the host profile ports (also referred to herein as "normally used ports") that are 
included in his host port profile based on TCP headers that are analyzed over a period 
of time (0067, 0069, 0070, 0074) to teach "a map port assignment, which was created 
when an application registered a service provided by the application at the time the 
application was brought up," "registered a service," and "a current port used by said 
registered service," as recited by independent Claim 1. For example, Applicants do not 
understand Copeland's automatic build up of normally used ports based on analyzed 
TCP header information to teach "registered." Further, Applicants do not understand 
Copeland's service associated with a port that is deemed to be "normally used" based 
on analyzing TCP headers over a period of time to teach "a registered service." 
Further, Copeland's host profile ports are used to determine if his "observed ports" are 
"in profile" (e.g., "normally used") or "out of profile (e.g., "not normally used"). Therefore, 
Applicants do not understand Copeland's host profile ports to teach "a current port used 
by said registered service." 

Applicants do not understand Copeland's ports that are observed (observed 
ports) from TCP header information to teach "authorized port and authorized service" or 
to teach "registered service." For example, Copeland's observed ports are not the ports 
that are in his host port profile. Instead, Copeland teaches determining whether his 
"observed ports" are "in profile" (e.g., "normally used") or "out of profile (e.g., "not 
normally used") by comparing the observed ports to his post port profile. Further, 
Copeland's observed port/service may be "normally used" or "not normally used," 
therefore, Applicants do not understand Copeland's observed port/service to teach a 
either "authorized port and authorized service" or "registered service." 
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Therefore, Applicants do not understand Copeland to teach "accessing port 
binding information, which includes an identification and an authorized port of an 
authorized service, in a port authorization file in said network; querying a port mapper 
for a mapped port assignment, which was created when an application registered a 
service provided by the application with said port mapper at the time said application 
was brought up, said mapped port assignment includes a current port used by said 
registered service; determining if an identified service is currently using said authorized 
port by comparing said mapped port assignment to said port binding information," as 
recited by independent Claim 1. 

THE OFFICE ACTION'S ASSERTIONS 
The Office Action states in the last sentence under bullet 2 on page 7, "In each 
Mode, new services are automatically detected, including 'current activities'. This 
implies that if an application which was just brought up registers a service and a new 
port is mapped for that service, port profile engine 155 would detect the new mapped 
port assignment in the "seen today list." Applicants respectfully submit that during 
Modes 1 and 2 (0070 and 0071) that ports are automatically added to Copeland's profile 
based on analyzed TCP information during the period of time that modes 1 and 2 are 
used, as described herein, and deemed to be "normally used ports." In mode 3 (0072) 
ports are not added. In mode 4 (0073) an alarm is generated if an observed port is not 
found in the profile (e.g., the ports that have been deemed during modes 1 and 2 as 
"normally used"). Therefore, the services that are observed during Copeland's modes 
1-4 do not teach or suggest "accessing port binding information, which includes an 
identification and an authorized port of an authorized service, in a port authorization file 
in said network; querying a port mapper for a mapped port assignment, which was 
created when an application registered a service provided by the application with said 
port mapper at the time said application was brought up, said mapped port assignment 
includes a current port used by said registered service; determining if an identified 
service is currently using said authorized port by comparing said mapped port 
assignment to said port binding information." 
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Further, even if an observed port is associated with an application that has just 
been brought up, this does not mean that Copeland teaches "querying a port mapper for 
a mapped port assignment, which was created when an application registered a service 
provided by the application with said port mapper at the time said application was 
brought up, said mapped port assignment includes a current port used by said 
registered service." Instead, Applicants understand Copeland to teach that ports for 
services that are not in Copeland's profile will be deemed as "unauthorized": and an 
alarm will be generated (0073 and last sentence of 0123). 

The Office Action states, "This implies that if an application which was just 
brought up registers a service and a new port is mapped for that service." However, 
Copeland does not teach that an application which was just brought up registers a 
service and a new port is mapped for that service. Instead, Applicants understand 
Copeland to teach that ports from TCP headers that are analyzed during the build up 
period (0069-0071) are deemed to be "normally used" and are therefore added to 
Copeland's profile. After the build up period, the "seen today" structure (also referred to 
as "current activity") is used to collect observed ports (0064, second to last sentence of 
0123). This current activity is then compared to the profile to determine if any of the 
ports in the current activity are "not normally used." Therefore, Applicants respectfully 
submit that one of Copeland's services that is a part of a "new activity" is not 
"registered" and is not automatically a part of Copeland's profile. Applicants respectfully 
submit that Copeland does not teach registering services. 

The Office Action appears to especially rely on paragraph 0123. More 
specifically, Applicants understand Copeland to teach at 0123 that there is a client at IP 
ADDRESS 1 requesting a service from a server at IP ADDRESS 2. The service is not a 
new service. Instead, it is an HTTP service, which is a well known service that is 
"normally used." Since it is normally used, there is a high probability that it would be 
included in Copeland's profile during mode 1 and 2 (0064, 0069-0071). Returning to 
0123, the server is using a low port 80 for HTTP that is preassigned and predetermined. 
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The client is using random high ports 51, 132. The port profiling engine updates both 
ADDRESS1 as the client utilizing port 80 and ADDRESS 0 as the server utilizing port 
80. Then a comparison can be made to determine if there is any unauthorized network 
usage. Therefore, Applicants respectfully submit that Copeland does not teach or 
suggest "accessing port binding information, which includes an identification and an 
authorized port of an authorized service, in a port authorization file in said network; 
querying a port mapper for a mapped port assignment, which was created when an 
application registered a service provided by the application with said port mapper at the 
time said application was brought up, said mapped port assignment includes a current 
port used by said registered service; determining if an identified service is currently 
using said authorized port by comparing said mapped port assignment to said port 
binding information," at 0123. 

SUMMARY 

As discussed herein, Applicants respectfully submit that the embodiment recited 
by independent Claim 1 is patentable for at least the reasons that Applicants do not 
understand Copeland to teach "accessing port binding information, which includes an 
identification and an authorized port of an authorized service, in a port authorization file 
in said network; querying a port mapper for a mapped port assignment, which was 
created when an application registered a service provided by the application with said 
port mapper at the time said application was brought up, said mapped port assignment 
includes a current port used by said registered service; determining if an identified 
service is currently using said authorized port by comparing said mapped port 
assignment to said port binding information," as recited by independent Claim 1. For 
similar reasons, Applicants respectfully submit that Copeland does not teach the 
embodiments recited by independent Claims 8 and 15. 

Claims 2-7 depend on independent Claim 1. Claims 9-14 depend on 
independent Claim 8. Claims 16-20 depend on independent Claim 15. These 
dependent claims include all of the features of their respective independent base 
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claims. Therefore, these dependent claims should be patentable for at least the 
reasons that their respective independent base claims should be patentable. 
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35 U.S.C. 103 

On page 8, the Office Action rejected Claims 7, 12, and 1 as being obvious under 
35 U.S.C. 103(a) in view of Copeland and further in view of U.S. Patent No. 6,988,208 
by Hrabik et al. (referred to hereinafter as "Hrabik"). Applicants have reviewed the 
asserted art and respectfully submit that neither Copeland nor Hrabik teach or suggest 
and the embodiment recited by amended independent Claim 1 for at least the following 
rationale. 

"As reiterated by the Supreme Court in KSR, the framework for the objective 
analysis for determining obviousness under 35 U.S.C. 103 is stated in Graham v. John 
Deere Co., 383 U.S. 1, 148 USPQ 459 (1966). Obviousness is a question of law based 
on underlying factual inquiries" including "[ascertaining the differences between the 
claimed invention and the prior art" (MPEP 2141(11)). "In determining the differences 
between the prior art and the claims, the question under 35 U.S.C. 103 is not whether 
the differences themselves would have been obvious, but whether the claimed invention 
as a whole would have been obvious" (emphasis in original; MPEP 2141.02(1)). 

NO MOTIVATION TO COMBINE 
This section describes Applicants' understanding of at least some of the reasons 
why there is no motivation to combine Copeland with any other asserted art, such as 
Hrabik, because Applicants understand Copeland to teach away from the embodiment 
recited by amended independent Claim 1. 

Applicants respectfully submit that "[i]t is improper to combine references where 
the references teach away from their combination" (emphasis added; MPEP 
2145(X)(D)(2); In re Grasselli, 713 F.2d 731, 743, 218 USPQ 769, 779 (Fed. Cir. 1983)). 
Applicants respectfully note that "[a] prior art reference must be considered in its 
entirety, i.e., as a whole , including portions that would lead away from the claimed 
invention" (emphasis in original; MPEP 2141.02(VI); W.L. Gore & Associates, Inc. v. 
Garlock, Inc., 721 F.2d 1540, 220 USPQ 303 (Fed. Cir. 1983), cert, denied, 469 U.S. 
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851 (1984)). Further, "[A] reference will teach away if it suggests that the line of 
development flowing from the reference's disclosures is unlikely to be productive of the 
result sought by the applicant. In re Gurley, 31 USPQ2d 1 130 (Fed. Cir. 1994)." More 
specifically, Applicants respectfully submit that there is no motivation to combine 
Copeland with any other asserted art, such as Hrabik, because Applicants understand 
Copeland to teach away from the embodiment recited by amended independent Claim 1 
for at least the following rationale. 

Applicants note that the board's decision dated February 25, 2010 drew a 
comparison between Copeland's automatic build up of ports in his post port profile to 
"querying a port mapper for a mapped port assignment." Applicants understand 
Copeland's automatic build up of the "normally used ports" (also referred to herein as 
"host profile ports") that are included in his host port profile based on TCP headers that 
are analyzed over a period of time (0067, 0069, 0070, 0074) to teach away from "a map 
port assignment, which was created when an application registered a service provided 
by the application at the time the application was brought up," "registered a service," 
and "a current port used by said registered service," as recited by independent Claim 1. 
For example, Applicants understand normally used ports that are determined using 
automatic build up over a period of time based on analyzed TCP header information to 
teach away from "registered." Further, Applicants understand a service that is 
determined to be associated with a normally used port based on TCP headers analyzed 
over a period of time to teach away from "a registered service." Further, Copeland's 
host profile ports (e.g., "normally used ports") are stored in Copeland's host port profile 
and are used to determine if his "observed ports" are "in profile" (e.g., "normally used") 
or "out of profile" (e.g., "not normally used"). Therefore, Applicants understand 
Copeland's host profile ports to teach away from "a current port used by said registered 
service." 

Applicants understand Copeland's ports that are observed (observed ports) from 
TCP header information to teach awav from "authorized port and authorized service" 
and teach awav from "registered service." For example, Copeland's observed ports are 
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not the normally used ports that are in his host port profile. Instead, Copeland teaches 
determining whether his "observed" are "in profile" (e.g., "normally used ports") or "out of 
profile" (e.g., "not normally used ports"). Further, Copeland's observed port/service, 
which may be either normally used or not normally used, does not teach a "registered 
service." Therefore, Applicants understand Copeland's ports that are observed from his 
TCP headers to teach away from "authorized port and authorized service" and to teach 
away from "registered service." 

Therefore, Applicants understand Copeland to teach away from "accessing port 
binding information, which includes an identification and an authorized port of an 
authorized service, in a port authorization file in said network; querying a port mapper 
for a mapped port assignment, which was created when an application registered a 
service provided by the application with said port mapper at the time said application 
was brought up, said mapped port assignment includes a current port used by said 
registered service; determining if an identified service is currently using said authorized 
port by comparing said mapped port assignment to said port binding information," as 
recited by independent Claim 1. 

SUMMARY 

Therefore, Applicants respectfully submit that the embodiment recited by 
independent Claim 1 is patentable for at least the reasons, as discussed herein, that 
Applicants believe that there is no motivation to combine Copeland with any other 
asserted art, such as Hrabik, for at least the reasons that Applicants understand 
Copeland to teach away from "accessing port binding information, which includes an 
identification and an authorized port of an authorized service, in a port authorization file 
in said network; querying a port mapper for a mapped port assignment, which was 
created when an application registered a service provided by the application with said 
port mapper at the time said application was brought up, said mapped port assignment 
includes a current port used by said registered service; determining if an identified 
service is currently using said authorized port by comparing said mapped port 
assignment to said port binding information," as recited by independent Claim 1. For 
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similar reasons, Applicants respectfully submit that Copeland does not teach the 
embodiments recited by independent Claims 8 and 15. 

Claim 7 depends on independent Claim 1. Claim 12 depends on independent 
Claim 8. Claim 19 depends on independent Claim 15. These dependent claims include 
all of the features of their respective independent base claims. Therefore, these 
dependent claims should be patentable for at least the reasons that their respective 
independent base claims should be patentable. 
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35 U.S.C. 103 

On page 9, the Office Action rejected Claim 13 as being obvious under 35 U.S.C. 
103(a) in view of Copeland and further in view of U.S. Patent No. 6,134,591 by Nickles 
(referred to hereinafter as "Nickles"). Applicants have reviewed the asserted art and 
respectfully submit that neither Copeland nor Nickles teach or suggest and the 
embodiment recited by amended independent Claim 1 for at least the following 
rationale. 

As presented herein, Applicants understand Copeland to teach awav from the 
embodiment recited by independent Claim 1. Since Copeland teaches away from the 
embodiment recited by independent Claim 1, Nickles cannot overcome the deficiency in 
Copeland because there is no motivation to combine Copeland with any other asserted 
art, such as Nickles. 

For at least these reasons, independent Claim 1 should be patentable over 
Copeland in view of Nickles. For similar reasons, independent Claim 8 should also be 
patentable over Copeland in view of Nickles. Claim 13 depends on independent Claim 
8 and includes all of the features of independent Claim 8. Therefore, Claim 13 should 
be patentable for at least the reasons that independent Claim 8 should be patentable. 
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CONCLUSION 

Based on the arguments presented above, Applicants respectfully assert that 
Claims 1-20 overcome the rejections of record and, therefore, Applicants respectfully 
solicit allowance of these Claims. 

The Examiner is invited to contact Applicants' undersigned representative if the 
Examiner believes such action would expedite resolution of the present Application. 



Respectfully submitted, 



Wagner Blecher LLP 



Dated: 07/27/2010 



/John P. Wagner Jr./ 



John P. Wagner, Jr. 
Registration No. 35,398 



Address: 



Westridge Business Park 

123 Westridge Drive 

Watsonville, California 95076 USA 



Telephone: 



(408) 377-0500 Voice 
(408) 234-3649 Direct/Cell 
(831) 722-2350 Facsimile 
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